A newly disclosed vulnerability, CVE-2026-44963, allows any authenticated domain user to execute code remotely on a Veeam Backup & Replication server, resulting in a full compromise of the enterprise backup infrastructure.
The flaw carries a critical severity rating and was patched in version 12.3.2.4854, released on June 5-9, 2026, with all builds up to and including 12.3.2.4465 affected.
Veeam credits the discovery to Sina Kheirkhah of watchTowr and confirms that the bug affects only domain-joined Backup Servers running version 12.x, while version 13.x is immune due to architectural changes introduced by Veeam.
Veeam Backup RCE Flaw
Tenable describes the flaw simply as enabling “remote code execution on the Backup Server by an authenticated domain user,” with no administrative privilege required.
.webp)
The Veeam Backup Service exposes a .NET Remoting endpoint on TCP port 8000, and the attack chain consists of three sequential calls that establish a session before delivering a malicious payload via deserialization of a BinaryFormatter.
Veeam attempts to defend this pipeline with a custom CProxyBinaryFormatter wrapped around a RestrictedSerializationBinder operating in blacklist mode, which blocks only known-dangerous classes rather than restricting execution to a safe allow-list.
Because the binder is permissive by default, any [Serializable] class not explicitly listed, including internal Veeam classes derived from System.Data.DataSet can be deserialized and abused to trigger code execution.
This is the same structural weakness behind a long lineage of prior Veeam CVEs, including CVE-2024-40711, CVE-2025-23120, and CVE-2025-23121, each patched by simply adding one more class name to the blacklist rather than fixing the underlying design.
SecureLayer stated that the 2025 wave of similar bugs noted that Veeam’s blacklist approach is “inherently always one step behind attackers,” since BinaryFormatter itself is a component Microsoft has called impossible to fully secure.
Veeam has acknowledged this and confirmed it removed BinaryFormatter entirely starting with version 13, which the company says “closes a chapter on this whole class of vulnerabilities”.
The same patch bundle that addresses CVE-2026-44963 also fixed several other 2026-series CVEs, some with even higher CVSS scores, though CVE-2026-44963 has drawn the most public attention due to its low authentication bar.
Prior related flaws, such as CVE-2025-48983 and CVE-2025-48984, similarly allowed authenticated domain users to reach code execution on backup infrastructure hosts, reinforcing that domain-joined Veeam deployments have been a recurring target.
Because the Backup Server centrally stores credentials for vCenter, ESXi hosts, cloud providers, and backup repositories, an attacker who gains code execution here can access the full backup catalog and tamper with or delete recovery points.
This makes the flaw especially dangerous as a pre-ransomware objective: compromising backups before deploying encryption payloads removes an organization’s last line of defense against extortion.
Mitigation
Organizations running any Veeam Backup & Replication v12 build on a domain-joined server should upgrade immediately to 12.3.2.4854 or later.
Veeam’s advisory also notes that workgroup-based deployments and Veeam Software Appliances are not affected by this vulnerability class, since the authorization check that permits any domain user relies on Active Directory membership.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
